Skip to content

Instantly share code, notes, and snippets.

Discover gists

@samsch
samsch / stop-using-jwts.md
Last active August 16, 2026 21:40
Stop using JWTs

Stop using JWTs!

TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.

If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)

A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/

The reason to avoid JWTs comes down to a couple different points:

  • The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions
@aarondfrancis
aarondfrancis / audit-your-codebase.md
Created August 14, 2026 15:20
A read-only, agent-orchestrated codebase audit prompt for data structures, state modeling, algorithms, and ownership.

Audit this entire codebase for materially useful simplifications in its data structures, state representation, control flow, algorithms, and ownership.

This is an audit-only exercise. Do not edit files, run tests, implement recommendations, commit, or push. Read-only inspection commands are allowed.

You are the coordinator. Continue until the complete codebase has been reviewed and the final audit is validated.

  1. Establish the coverage contract

Inspect the repository and inventory every identifiable subsystem.

@SylvanFranklin
SylvanFranklin / Unconventional-Commit-Cheatsheet.md
Last active August 16, 2026 21:38
Unconventional Commits

Unconventional Commit Messages

See how major changes to your commit message style can make you many new enemies.

Tip

Unlike their conventional counterpart these bad boys aren't consistent at all. The specification will change rapidly without warning, and different versions will vie for dominance like Javascript frameworks.

Message Formats

Default

@HelgeSverre
HelgeSverre / coop-norway-api.openapi.json
Last active August 16, 2026 21:36
Norwegian Grocery Store APIs — Reverse-engineered API documentation for Rema 1000, Coop Norway, and Trumf (extracted from Android APKs)
{
"openapi": "3.1.0",
"info": {
"title": "Coop Norway Medlem API",
"version": "4.17.3",
"description": "Reverse-engineered API specification for the Coop Norway \"Coop medlem\" Android app (no.coop.members v4.17.3). Extracted via static analysis of the compiled Dart binary (libapp.so) from the Flutter APK.\n\nThis API powers Norway's Coop loyalty program including purchase history, digital receipts, coupons, Coopay mobile payment, shopping lists, and Shop Express.\n\n**Authentication:** OpenID Connect via Auth0 at https://login.coop.no/\n**Strong Customer Auth (Coopay):** Aera SDK at https://api.aerahost.com/\n\n⚠️ Unofficial, reverse-engineered spec. Use responsibly for personal data access only.",
"contact": { "name": "Helge Sverre", "url": "https://helgesver.re" },
"license": { "name": "MIT" }
},
"servers": [
@andrew-kramer-inno
andrew-kramer-inno / patch_codex_app_asar.py
Created February 4, 2026 11:19
#!/usr/bin/env python3
"""
Patch the installed Codex macOS app by editing its Electron ASAR webview bundle.
WARNING: Modifying files inside `/Applications/Codex.app` will break the app's code signature.
You may need to re-sign the app (or adjust Gatekeeper settings) after patching.
Codex.app also enables Electron's ASAR integrity check. After repacking `app.asar`, you must
update `ElectronAsarIntegrity` in `Codex.app/Contents/Info.plist`, otherwise the app will exit
on startup with:
@minaayman10
minaayman10 / SECURITY_COURSES.md
Created August 16, 2026 21:23 — forked from DAEMON-404/SECURITY_COURSES.md
SANS-Courses

Cyber Security Certification Resources

Category Type Status

A collection of SANS/GIAC training materials and related cybersecurity resources.

Note: These resources are for educational purposes.

@gabrielfroes
gabrielfroes / prompt-de1click.md
Last active August 16, 2026 21:20
Prompt Replit para Aplicação Web Lista de Links

Crie um SaaS chamado de1.click

O de1.click é uma plataforma em português do Brasil para criação de páginas de links para redes sociais, semelhante a uma versão mais simples, rápida e objetiva do Linktree.

O público-alvo são empresários, freelancers, desenvolvedores, criadores de conteúdo, profissionais de marketing, jovens empreendedores e pessoas que precisam divulgar vários links em um único lugar.

A principal proposta do produto é simplicidade. O usuário deve conseguir criar sua página pública em poucos minutos, com uma experiência moderna, mobile first e intuitiva.

O fluxo principal do usuário deve ser: